Data processing agreement
Last updated: 26 September 2026
Verwerkersovereenkomst — this agreement (Art. 28 GDPR) applies between you (the business, “Controller”) and Toolee (“Processor”) for all personal data you process with Toolee. It forms part of our Terms of Service and is accepted when you create a Toolee account.
1. Subject and duration
The Processor processes personal data on behalf of the Controller to provide the Toolee service: website hosting, online reservations, customer management (CRM), invoicing and messaging. This agreement lasts as long as the Controller uses Toolee.
2. Categories of data and data subjects
| Data subjects | Personal data |
|---|---|
| Customers and guests of the Controller | Name, e-mail, phone, reservation details, notes, invoice data, messages |
| Website visitors of the Controller | Anonymous visit counts; IP address only briefly for abuse prevention |
| Team members of the Controller | Name, e-mail, login data |
3. Processor obligations
- Processes personal data only on documented instructions of the Controller, which consist of the Controller's use of Toolee and its settings.
- Ensures that everyone with access to the data is bound by confidentiality.
- Implements appropriate technical and organisational measures (Art. 32 GDPR), including encryption in transit (HTTPS), hashed passwords, strict separation of each business's data, access control and regular backups.
- Assists the Controller with requests from data subjects. Toolee offers self-service tools for this: exporting a customer's data and deleting customers.
- Notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach, with the information the Controller needs for its own notification obligations.
- Assists with data protection impact assessments and prior consultations where required.
- Makes available all information necessary to demonstrate compliance and allows for reasonable audits, with reasonable prior notice.
4. Sub-processors
The Controller gives general authorisation for the following sub-processors. We'll inform you at least 30 days before adding or replacing a sub-processor, so you can object.
| Sub-processor | Purpose | Location / safeguards |
|---|---|---|
| Vercel Inc. | Hosting and content delivery of the application (region: Frankfurt, EU) | EU / USA (EU-US Data Privacy Framework) |
| Neon Inc. | Database hosting | Region as configured; USA locations under the EU-US Data Privacy Framework |
| Mollie B.V. | Subscription payments | Netherlands (EU) |
| E-mail service provider | Sending transactional e-mails (booking confirmations, invoices, password resets) | EU |
5. International transfers
Transfers outside the EEA only take place on the basis of an adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses.
6. End of the agreement
When the Controller deletes its business, all personal data is deleted within 30 days, unless retention is required by law. Before deletion, the Controller can export its data (customers as CSV, invoices as PDF).
7. Controller obligations
The Controller is responsible for having a legal basis for processing, for informing data subjects (Toolee generates a privacy statement for every business website, which the Controller should check and complete), and for the lawfulness of its instructions.
8. Liability and law
The limitation of liability in our Terms applies. This agreement is governed by Dutch law. Questions: privacy@toolee.nl.